Results for “github”

Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-audience confusion (Argo CD CVE-2023-22482). For standalone JWT signature/crypto forging (alg:none, key confusion, kid/jku) see hunt-jwt-crypto; this skill covers JWT only inside SSO/SAML/token-trust bypass chains. SAML assertion-layer attacks (XSW, comment injection, signature stripping, XXE-in-assertion) are owned by hunt-saml; this skill owns the broader cross-protocol auth-bypass taxonomy. Use when hunting auth bypass — see the Legacy-Protocol Matrix for branded-UI vs legacy-endpoint patterns.

The English summary is being prepared. Showing the original description.

Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for usi...

The English summary is being prepared. Showing the original description.

Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private scoped packages and .npmrc misconfigurations where registry mappings fail to pin internal scopes exclusively. Addresses PyPI namespace attacks through --extra-index-url resolution ordering, NuGet feed priority exploitation when multiple package sources are configured without clear directives, Maven and Gradle repository ordering where artifact resolution traverses repositories sequentially, Go module proxy abuse through GOPROXY misconfiguration, Ruby gems namespace squatting, and Docker image tag confusion with unqualified image references. Provides complete proof-of-concept methodology using safe callbacks including DNS canary via interactsh or Burp Collaborator and HTTP beacon with no destructive payload. Covers reconnaissance techniques for discovering internal package names through GitHub repository analysis, error ...

The English summary is being prepared. Showing the original description.

Target discovery methodology for finding high-quality npm/PyPI/GitHub packages to audit for vulnerabilities, with evaluation criteria and search strategies.

The English summary is being prepared. Showing the original description.

Mine GitHub Security Advisories and CVE databases for incomplete fixes, finding variant vulnerabilities in patched code or similar patterns in related packages.

The English summary is being prepared. Showing the original description.

Use the Fly.io flyctl CLI for deploying and operating apps on Fly.io: deploys (local or remote builder), viewing status/logs, SSH/console, secrets/config, scaling, machines, volumes, and Fly Postgres (create/attach/manage databases). Use when asked to deploy to Fly.io, debug fly deploy/build/runtime failures, set up GitHub Actions deploys/previews, or safely manage Fly apps and Postgres.

The English summary is being prepared. Showing the original description.

Stage, commit, and push git changes with conventional commit messages. Use when user wants to commit and push changes, mentions pushing to remote, or asks to save and push their work. Also activates when user says "push changes", "commit and push", "push this", "push to github", or similar git workflow requests.

The English summary is being prepared. Showing the original description.

Query the DeepWiki MCP server for GitHub repository documentation, wiki structure, and AI-powered questions.

The English summary is being prepared. Showing the original description.

Free AI search via Exa MCP. Web search for news/info, code search for docs/examples from GitHub/StackOverflow, company research for business intel. No API key needed.

The English summary is being prepared. Showing the original description.

Free AI search via Exa MCP. Web search for news/info, code search for docs/examples from GitHub/StackOverflow, company research for business intel. No API key needed.

The English summary is being prepared. Showing the original description.

Use when the user wants to start tracking a local custom instruction file (like .agy/ANTIGRAVITY.md or .github/copilot-instructions.md) in SuperCtx. Requires a path argument.

The English summary is being prepared. Showing the original description.

Set up @changesets/cli for semantic versioning, CHANGELOG generation, and npm publishing in a monorepo or single package. Covers init, config, contributor workflow, GitHub Actions release automation, and npm provenance.

The English summary is being prepared. Showing the original description.

Create a GitHub PR with an engineered description that matches the team's established format — numbered problem-fix sections, technical tables, file-by-file breakdowns, commit lists, and verification checklists. Use this skill whenever the user asks to create a PR, ship code, prepare a merge request, write a PR description, or says anything like "ship to boss", "pr perfect", "make a PR", "prepare PR for merge", "create pull request", "engineer the PR", "PR description", or "ready to push". Also trigger when the user has finished a batch of work and says things like "let's wrap this up", "time to merge", "push this to main", or "get this ready for review". The skill handles everything: commit analysis, description generation, branch creation, and PR submission via gh CLI.

The English summary is being prepared. Showing the original description.

Review and resolve PR issues with Qodo - get AI-powered code review issues and fix them interactively (GitHub, GitLab, Bitbucket, Azure DevOps)

The English summary is being prepared. Showing the original description.

Tiered web access router. TIER 1 insane-search: headless extraction plus WAF bypass via curl_cffi, yt-dlp, Jina Reader, public APIs, Playwright fallback for blocked/403/Cloudflare pages, articles, YouTube subtitles. TIER 1.5 agent-reach: platform-native readers for Chinese/social platforms: Xiaohongshu, Douyin, Weibo, Bilibili, V2EX, WeChat, plus Twitter/Reddit/LinkedIn/GitHub. TIER 2 aside-browser FIRST (user's real logged-in browser: aside exec agent, aside repl Playwright), then CloakBrowser + agent-browser as the stealth fallback: source-patched stealth Chromium (CloakBrowser) driven over CDP by the agent-browser CLI for clicks, forms, screenshots, video, cookie login, QA/dogfood, Electron apps. Triggers: browse, stealth browser, CloakBrowser, agent-browser, cloak launch, bypass bot detection, blocked site, scrape, fill form, screenshot, import cookies, play youtube, podcast transcript. NOT for simple searches (web-search), fetches (webfetch), or messaging/workspace platforms — Slack/Discord/Notion/Gmail have Tier-1 CLIs in external-communication; come here only as its fallback.

The English summary is being prepared. Showing the original description.

Build, improve, package, and review Codex skills from rough ideas, workflows, scripts, README/API/CLI docs, or existing skill folders. Use when the user wants to create a new Codex skill, convert a repeatable workflow into a reusable skill, scaffold SKILL.md plus references/scripts/assets, validate a skill, or prepare a skill for sharing on GitHub.

The English summary is being prepared. Showing the original description.

Guides an agent through reproducing, root-causing, fixing, and validating flaky tests in the PostHog monorepo. Use when a test fails intermittently in CI but passes on rerun or locally, when `hogli ci:insights` or the debugging-ci-failures skill classifies a failure as a flaky test, when given a GitHub Actions URL for a flaky job, when asked to check Trunk Flaky Tests for a test, PR, or master, or when asked to deflake, stabilize, or fix a flaky Jest, pytest, or Playwright test. Core discipline: reproduce locally before changing anything, fix the root cause (never mask it with sleeps, retries, or bigger timeouts), and prove the fix with an N-run validation loop sized to the observed failure rate. Stabilizing is not the only valid outcome — the skill also gates whether the test should exist, so deleting a test that catches nothing real, or re-leveling one that flakes because of the level it runs at, are first-class endings.

The English summary is being prepared. Showing the original description.